Alert Logic Web Security Manager for Amazon Web Services Direct (Windows)

Create a security group for protected hosts

A security group acts as a firewall that controls the traffic allowed to reach your instances.

To create a security group for protected hosts:

1. Log into the Amazon Web Services console, and then navigate to EC2.
2. In the navigation pane, click Security Groups.
3. Click Security Group.

4. In Create Security Group:
   • In Name, enter Alert Logic TM Protected.
   • In Description, enter Alert Logic Threat Manager Protected Hosts.
   • In VPC,
     • If you do not have a VPC, select No VPC from the drop-down menu.
     • If you have a VPC, select the desired VPC ID from the drop-down menu.
       
       
5. Click Yes, Create.

Create a security group for the appliance

To create a security group for an appliance:

1. Log into the Amazon Web Services console, and then navigate to EC2.
2. In the navigation pane, click Security Groups.
3. Click Security Group.

4. In Create Security Group:
   • In Name, type Alert Logic TM Appliance.
   • In Description, type Alert Logic Threat Manager Appliances.
   • In VPC,
     • If you do not have a VPC, select No VPC from the drop-down menu.
     • If you have a VPC, select the desired VPC ID from the drop-down menu.
5. Click Yes, Create.

Set up rules for appliances and protected hosts

Be sure to set up the following rules:

• Inbound appliance rules
• Outbound appliance rules
• Rules for protected host security group

Set up inbound appliance rules

To edit a inbound appliance rules in a security group:

1. Log into the Amazon Web Services console, and then navigate to the EC2 section.

2. In the navigation pane, click Security Groups.

3. Select the security group you want to edit.

4. Click the Inbound tab.

5. Apply the appropriate rules:
   
   To use the US data center:

   Source	Destination	Protocol	Port	Description
   0.0.0.0/0	Appliance	TCP	80	Appliance claim
   Agent(s) CIDR- network subnet range for the agent(s)	Appliance	TCP	443	Agent updates, agent routing, log collection
   208.71.209.32/27	Appliance	TCP	4849	Appliance user interface
   204.110.218.96/27	Appliance	TCP	4849	Appliance user interface
   204.110.219.96/27	Appliance	TCP	4849	Appliance user interface
   Agent(s) CIDR- network subnet range for the agent(s)	Appliance	TCP	7777	Agent data transport (between agent and appliance on local network)

   Port 22 is required for troubleshooting during the provisioning process only. After the provisioning process is complete, you may close the port.

   *Replace with “Alert Logic TM Protected Hosts” Security Group ID.

   To use the EU data center:

   Source	Destination	Protocol	Port	Description
   Agent(s) CIDR- network subnet range for the agent(s)	Appliance	TCP	443	Agent updates
   Agent(s) CIDR- network subnet range for the agent(s)	Appliance	TCP	7777	Agent data transport (between agent and appliance on local network)
   0.0.0.0/0	Appliance	TCP	80	Appliance claim
   185.54.124.0/24	Appliance	TCP	4849	Appliance user interface (Web Security Manager)

   Port 22 is required for troubleshooting during the provisioning process only. After the provisioning process is complete, you may close the port.
6. Click Apply Rule Changes.

Set up outbound appliance rules

Outbound firewall rules for AWS pertain only to VPC customers. By default, the outbound rules open any port to any destination. These firewall rules are acceptable, but you can edit them.

To edit outbound appliance rules in a security group:

1. Log into the Amazon Web Services console, and then navigate to the EC2 section.

2. In the navigation pane, click Security Groups.

3. Select the security group you want to edit.

4. Click the Outbound tab.

5. Apply the appropriate rules:
   
   To use the US data center:

   Source	Destination	Protocol	Port	Description
   Appliance	8.8.4.4	TCP/UDP	53	DNS
   Appliance	8.8.8.8	TCP/UDP	53	DNS
   Appliance	0.0.0.0/0	TCP	80	Appliance updates
   Appliance	204.110.218.96/27	TCP	443	Updates
   Appliance	204.110.219.96/27	TCP	443	Updates
   Appliance	208.71.209.32/27	TCP	443	Updates
   Appliance	208.71.209.32/27	TCP	4138	Event transport
   Appliance	204.110.218.96/27	TCP	4138	Event transport
   Appliance	204.110.219.96/27	TCP	4138	Event transport
   Appliance	204.110.219.96/27	UDP	123	NTP, time sync
   Appliance	208.71.209.32/27	UDP	123	NTP, time sync

   To use the EU data center:

   Source	Destination	Protocol	Port	Description
   Appliance	185.54.124.0/24	TCP	443	Updates
   Appliance	185.54.124.0/24	TCP	4138	Event transport
   Appliance	8.8.8.8	TCP/UDP	53	DNS
   Appliance	8.8.4.4	TCP/UDP	53	DNS
   Appliance	0.0.0.0/0	TCP	80	Appliance updates
   Appliance	185.54.124.0/24	UDP	123	NTP, time sync

6. Click Apply Rule Changes.

Set up rules for protected host security group

1. Select VPC Security Groups, from the Viewing pull-down menu.
2. Click the Outbound tab, and apply the following rules, as necessary:
   
   To use the US data center:

   Create a new rule	Port range	Destination
   Custom TCP Rule	7777	<Appliances>*
   Custom TCP Rule	443	204.110.218.96/27
   Custom TCP Rule	443	204.110.219.96/27
   Custom TCP Rule	443	208.71.209.32/27

   To use the EU data center:

   Create a new rule	Port range	Destination
   Custom TCP Rule	7777	<Appliances>*
   Custom TCP Rule	443	185.54.124.0/24

   * In the above examples, replace <Appliances> with the Alert Logic TM Appliances security group ID.

3. Click Apply Rule Changes.
4. Repeat these instructions for every protected host security group associated with the appliance you configure.

Download the agent

To download the agent:

1. In the Alert Logic console, open the Settings menu, and then click Support Information.
2. From the menu bar, click Quick Install Guide and Downloads.
3. Download the appropriate agent and follow the on-screen instructions.
   • For Windows users, click Windows Agents, and then select the desired agent.
   • For Linux users, click Linux Agents. Linux users can select either Debian-based agent installers or RPM-based agent installers. Both installers are available in a 32-bit or 64-bit format.
     
4. Locate the Unique Registration Key from the Downloads screen. Copy your unique registration key. You will need to enter this key to install the agent.
   

Install the agent for Windows

Install the agent via the GUI

To install the agent:

1. Run the MSI package.
2. Leave the Provisioning API Key field blank.
3. In Proxy Setting, select a connection method if you want traffic to pass through a proxy. You can connect via Direct Connection or a web proxy. You can also enter the URL of the proxy server.
   
4. In Provision, select After Setup.
5. Click Install.

Install the agent via command prompt with image capture

To install the agent:

1. Copy the MSI file to the target machine.
2. Type the following command: 
   

   msiexec /i [path to MSI file] install_only=1 /q

   • /i installs the agent normally
   • Command prompt example:
     msiexec /i c:\downloads\al-agent-1.0.33.msi install_only=1 /q

3. (Optional) If you set up a NAT or virtual appliance that you want to use as a single point of egress, enter the corresponding host name or IP address or port via the following command prompt parameters:
   • sensor_host=[host] indicates the IP address where the agent should forward logs.
   • sensor_port=[port] indicates the TCP port where the agent should connect.
4. When image preparation is complete configure the Alert Logic agent to start automatically after reboot: sc config al_agent start= auto
5. In the EC2 console, stop the running instance.
6. To create a new AMI, right-click the stopped instance, then click Image, and then click Create Image. In Create Image, enter a name and description for the new AMI, and then select No Reboot.
7. (Optional) Start an instance from the newly created AMI, and verify that the agent has registered with the Alert Logic console.
   If you need to edit your OS image, do not register the agent in the Alert Logic console.
   • To stop the agent, enter sc stop al_agent
   • If the following files are present, remove the files: %CommonProgramFiles(x86)%\AlertLogic\host_crt.pem and %CommonProgramFiles(x86)%\AlertLogic\host_key.pem where %CommonProgramFiles(x86)% refers to "C:\Program Files\Common Files" for x86 versions of windows and "C:\Program Files (x86)\Common Files" for amd64 and ia64 versions.

Create an assignment policy

An assignment policy is a set of rules that indicates to appliances how to handle incoming traffic; the appliance will either accept or ignore the traffic. An assignment policy directs protected hosts to encrypt traffic and send traffic to specific appliances. In a dynamic environment where IP addresses often change, an assignment policy ensures that hosts always correspond to their appliances.

To create an assignment policy:

1. In the Alert Logic console, click CONFIGURATION, and then click Deployments.
2. In the left navigation area, click Policies.
3. Click the Assignment tab.
4. Click the Add icon ().
5. In Appliance Assignment Policy Name, enter a name.
6. In Appliances, select an appliance.
7. Click Save.

Assign a policy to a protected host

To assign a policy to a protected host:

1. In the Alert Logic console, click CONFIGURATION, and then click Deployments.
2. Click the All Deployments tile.
3. In the left navigation pane, click Networks and Hosts, and then click the Protected Hosts tab.
4. Click the pencil icon ( ) for the desired protected host.
5. Select Use an Existing Assignment Policy.
6. From the Existing Assignment Policy drop-down menu, select the assignment policy you want to use.
7. Click SAVE.

Related topics